This Privacy Policy sets out the rules for the processing of personal data obtained through the website www.grelkam.pl (hereinafter referred to as the "Website").
The data controller is Kamil Grelewski, sole trader operating under the name Firma Handlowo-Usługowa GRELKAM Kamil Grelewski, entered in the Central Register and Information on Economic Activity (CEIDG) kept by the minister responsible for the economy, NIP: 8982124296, REGON: 020624222.
Personal data collected by Kamil Grelewski, sole trader operating under the name Firma Handlowo-Usługowa GRELKAM Kamil Grelewski, via the GRELKAM online store, hereinafter referred to as: the Administrator, is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), also known as the GDPR.
The Administrator takes special care to respect the privacy of Users visiting the Website.
§ 2
Type and purposes of data processing
The Controller collects information about natural persons conducting business or professional activity on their own behalf and natural persons representing legal persons or organisational units that are not legal persons, to whom the law grants legal capacity, hereinafter collectively referred to as Users.
Users' personal data is collected in the following cases:
placing an order on the Website, for the purpose of performing the contract. Legal basis: necessary for the performance of a contract for the provision of services.
In the case of Entrepreneurs, the above scope of data is additionally extended to include the Entrepreneur's company name and VAT number.
When placing an order on the Website, the User provides the following data:
e-mail address
address details
first and last name
telephone number.
In the case of Entrepreneurs, the above scope of data is additionally extended to include the Entrepreneur's company name and VAT number.
The provision of personal data to the Shop is voluntary in connection with the conclusion of sales contracts, with the proviso, however, that failure to provide the User's data specified in the forms will prevent the User's order from being placed and processed.
§3
Selected data protection methods used by the Administrator
The places where you log in and enter your personal data are protected at the transmission layer (SSL certificate). Thanks to this, personal data and login details entered on the website are encrypted on the user's computer and can only be read on the target server.
An important element of data protection is the regular updating of all software used by the Operator to process personal data, which in particular means regular updates of programming components.
§ 4
Sharing or entrusting data
The User's personal data is transferred to service providers used by the Administrator in the operation of the Website. Depending on contractual arrangements and circumstances, service providers to whom personal data is transferred are either subject to the Administrator's instructions regarding the purposes and methods of processing such data (processors) or independently determine the purposes and methods of processing (administrators).
Processors. The Administrator uses providers who process personal data exclusively on the Administrator's instructions. These include, among others, providers of hosting services, accounting services, marketing systems, systems for analysing traffic on the Website, and systems for analysing the effectiveness of marketing campaigns.
Processors. The Controller uses providers who do not act solely on the instructions of the Controller and who themselves determine the purposes and means of using Users' personal data. They provide electronic payment and banking services.
Users' personal data is stored:
if the basis for the processing of personal data is the Administrator, then the User's personal data is processed by the Administrator until the consent is revoked, and after the consent is revoked, for a period corresponding to the limitation period for claims that may be raised by the Administrator and that may be raised against him. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to business activity - three years.
If the basis for data processing is the performance of a contract, the User's personal data shall be processed by the Administrator for as long as it is necessary to perform the contract, and after that time for a period corresponding to the limitation period for claims. Unless otherwise specified, the limitation period is six years, and for claims for periodic benefits and claims related to business activities - three years.
In the event of a request, the Controller shall disclose personal data to authorised state authorities, in particular to organisational units of the Public Prosecutor's Office, the Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection or the President of the Office of Electronic Communications.
§ 5
Rights of data subjects
Right to withdraw consent:
The user has the right to withdraw any consent given to the Administrator.
The withdrawal of consent takes effect from the moment of withdrawal.
Withdrawal of consent does not affect the processing carried out by the Controller in accordance with the law prior to its withdrawal.
Withdrawal of consent does not entail any negative consequences for the User, but it may prevent further use of services or functionalities which, in accordance with the law, the Controller may only provide with consent.
Right to object to data processing:
The User has the right to object at any time, on grounds relating to their particular situation - to the processing of their personal data, including profiling, if the Administrator processes their data on the basis of a legitimate interest, keeping statistics on the use of individual functionalities of the Website and facilitating the use of the Website, as well as conducting satisfaction surveys.
Opting out by e-mail from receiving marketing communications about products or services will mean that the User objects to the processing of their personal data, including profiling for these purposes.
If the User's objection proves to be justified and the Controller has no other legal basis for processing personal data, the User's personal data will be deleted, the processing of which the User has objected to.
Right to erasure:
The User has the right to request the deletion of all or some of their personal data.
The User has the right to request the deletion of personal data if:
the personal data is no longer necessary for the purposes for which it was collected or processed,
the User has withdrawn their consent to the extent that the personal data was processed on the basis of their consent,
they have objected to the use of their data for marketing purposes,
the personal data is being processed unlawfully,
the personal data must be erased in order to comply with a legal obligation under Union or Member State law.
Despite a request for the erasure of personal data, in connection with an objection or withdrawal of consent, the Controller may retain certain personal data to the extent that processing is necessary for the establishment, exercise or defence of legal claims, as well as for compliance with a legal obligation which requires processing under Union or Member State law. This applies in particular to personal data including: first name, surname, e-mail address, which are retained for the purpose of handling complaints and claims related to the use of the Website's services, or additionally the address of residence/correspondence address, order number, which are retained for the purpose of handling complaints and claims related to concluded sales contracts or the provision of services.
Right to restrict data processing:
The user has the right to request the restriction of the processing of their personal data. Until the request is considered, it prevents the use of certain functionalities or services, the use of which will involve the processing of data covered by the request. The administrator will also not send any communications, including marketing communications.
The user has the right to request the restriction of the use of personal data in the following cases:
when they question the accuracy of their personal data – in this case, the Controller shall restrict its use for the time necessary to verify the accuracy of the data, but for no longer than 7 days,
when the processing of data is unlawful and, instead of deleting the data, the User requests that its use be restricted,
when personal data is no longer necessary for the purposes for which it was collected or used, but is needed by the User to establish, pursue or defend claims,
when the User has objected to the use of their data – in this case, the restriction shall apply for the time necessary to consider whether, due to the specific situation, the protection of the User's interests, rights and freedoms outweighs the interests pursued by the Controller in processing the User's personal data.
Right of access to data:
The User has the right to obtain confirmation from the Controller as to whether personal data is being processed, and if so, the User has the right to:
obtain access to their personal data,
obtain information about the purposes of processing, the categories of personal data being processed, the recipients or categories of recipients of such data, the planned period of storage of the User's data or the criteria for determining that period (where it is not possible to specify the planned period of data processing), the rights of the User under the GDPR and the right to lodge a complaint with a supervisory authority, the source of the data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of the data outside the European Union.
Right to rectification:
The User has the right to request the Controller to immediately rectify any personal data concerning him or her that is incorrect. Taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data, including by providing an additional statement, by sending a request to the e-mail address.
Right to data portability:
The User has the right to receive their personal data that they have provided to the Administrator and then send it to another personal data administrator of their choice. The User also has the right to request that the personal data be sent directly by the Administrator to such an administrator, if technically possible.
If the User exercises their rights under the above provisions, the Controller shall comply with the request or refuse to comply with it immediately, but no later than within one month of receiving it. However, if the Controller is unable to comply with the request within one month, it shall comply with it within the next two months, informing the User in advance, within one month of receiving the request, of the intended extension of the deadline and the reasons for it.
The User may submit complaints, queries and requests to the Administrator regarding the processing of their personal data and the exercise of their rights.
The User has the right to request the Administrator to provide a copy of the standard contractual clauses by submitting a query.
The User has the right to lodge a complaint with the President of the Personal Data Protection Office regarding the violation of their rights to personal data protection or other rights granted under the GDPR.
§ 6
Additional information on the use of data
In certain situations, the Controller has the right to transfer your personal data to other recipients if it is necessary to perform the contract concluded with you or to fulfil the obligations incumbent on the Controller. This applies to the following groups of recipients:
Couriers
Postal operators
Law firms and debt collectors
Payment operators
Authorised employees and associates who use the data to perform the website's activities.
§ 7
Additional use of personal data
The website additionally uses personal data for the following purposes:
Handling enquiries via the form
Preparation, packaging and shipment of goods
Provision of ordered services
Debt collection
Presentation of offers or information.
The website collects information about users and their behaviour in the following ways:
Through data voluntarily entered in forms, which is entered into the Operator's systems.
By storing cookies on end devices.
§ 8
Security management
The Administrator provides Users with a secure and encrypted connection when transferring personal data on the Website.
The Administrator uses an SSL certificate issued by one of the world's leading companies in the field of security and encryption of data transmitted over the Internet.
§ 9
Consent to the processing of personal data
The User consents to the processing of personal data by Kamil Grelewski, sole trader operating under the name Firma Handlowo-Usługowa GRELKAM Kamil Grelewski, for the purposes of direct marketing of his own products and services. Data for this purpose will be processed on the basis of Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).
